# Subcategories do not inherit permissions from parent category
**URL:** https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174
**Category:** Feature
**Created:** [July 3, 2014, 6:41pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174 "2014-07-03T18:41:49Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@coubeatczech](https://meta.discourse.org/u/coubeatczech)
#### Post date: [July 3, 2014, 6:41pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/1 "2014-07-03T18:41:49Z")
This is looks as a very severe bug, so apologies if someone already posted it, but I don’t know how to search for it. Here it goes:
**The bug**
Given I’m user who is not in the group **staff** ,
When I go to the main listing of topics - **/** root of the discourse,
Then I see even the topics, that should be hidden to me, because I don’t have read privileges for them.
Also, in the listing, I can see the topic title, but the topic category is hidden.
When I click on the topic, that should be hidden, only header will remain, with the rest of the page blank with this error in console:
```plaintext
Uncaught TypeError: Cannot read property ' __ember_meta__' of undefined vendor-0cf7f8ddcf2bd3b5854f3b875e88d515.js:6
```
**Version:** 0.9.9.11
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [July 3, 2014, 6:48pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/2 "2014-07-03T18:48:03Z")
This sounds related to
[https://meta.discourse.org/t/unauthenticated-users-can-see-topics-in-private-categories/16577](https://meta.discourse.org/t/unauthenticated-users-can-see-topics-in-private-categories/16577)
But it looks like you are running the latest version, so it must be different somehow…
---
### Author:  [@shiningdracon](https://meta.discourse.org/u/shiningdracon)
#### Post date: [July 3, 2014, 6:52pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/3 "2014-07-03T18:52:42Z")
I noticed this too.
Is there a sub category under staff?
In my case, If I set the parent category AAA’s permission as ‘admin can read’ for example, but set sub category BBB’s permission as ‘everyone can read’, then everyone can see the topic title posted in BBB. And when click that topic, will see a blank page.
---
### Author:  [@coubeatczech](https://meta.discourse.org/u/coubeatczech)
#### Post date: [July 3, 2014, 7:04pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/4 "2014-07-03T19:04:39Z")
The difference is that in my case, the user is authenticated, but apart from that, it is the same, the super category has permission - only **staff** can read, yet it can be seen on the listing by non-staff users.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [July 3, 2014, 7:06pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/5 "2014-07-03T19:06:27Z")
Can you post your category security settings involved?
---
### Author:  [@coubeatczech](https://meta.discourse.org/u/coubeatczech)
#### Post date: [July 3, 2014, 7:06pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/6 "2014-07-03T19:06:39Z")
Yes, in my case it is the same. By **staff** I meant the discourse group. **staff** has access to topic _ **AAA** _, whereas others don’t have, but the others still can see the topic’s titles in the listings.
---
### Author:  [@coubeatczech](https://meta.discourse.org/u/coubeatczech)
#### Post date: [July 3, 2014, 7:22pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/7 "2014-07-03T19:22:19Z")
The supercategory has setting, that only **staff** group can read/write, but the subcategory has permission, that **anybody** can read/write, which kind of doesn’t make sense if the subcategory inherits the permission scheme from the supercategory. Does it?
I set this configuration with the following steps and thoughts: I set up the permissions supercategory, and then removed all permissions from the subcategory, thinking that the subcategory will inherit it, but it looks like that the subcategory gets assigned **anybody** rights if I save there the permissions with no rights at all.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [July 3, 2014, 7:56pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/8 "2014-07-03T19:56:09Z")
Yes, you will have to redeclare the permissions for every subcategory. There is no inheritance of permissions.
---
### Author:  [@fantapop](https://meta.discourse.org/u/fantapop)
#### Post date: [December 10, 2015, 6:06pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/9 "2015-12-10T18:06:30Z")
I’d like to resurface this feature request. At the very least, there should be a warning during subcategory creation that permissions of the parent are different and not inherited.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [December 10, 2015, 6:32pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/10 "2015-12-10T18:32:53Z")
If subcategories are going to inherit permissions, it needs to be optional! A quick example off the top of my head would be an “archive” type subcategory, where typical users can read, but not start new topics, where the category it is a part of has “everyone” permissions.
---
### Author:  [@dardub](https://meta.discourse.org/u/dardub)
#### Post date: [February 8, 2018, 7:19pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/11 "2018-02-08T19:19:47Z")
Why can’t permissions be inherited by default, with the option to override/change on the sub-category? This is troublesome when admins create sub-categories on a Staff category and inadvertently due to lack of knowledge or forgetfulness, don’t set the permissions.
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [February 9, 2018, 8:36am UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/12 "2018-02-09T08:36:58Z")
I tend to agree, as I suspect we are deviating from the norm here.
A checkbox for “inherit permissions of parent category” enabled by default would make a lot of sense.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [February 9, 2018, 8:52am UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/13 "2018-02-09T08:52:52Z")
I’ll add myself to the set of people for whom inheriting permissions from the parent category would be the least surprising behaviour. It’s also the safer option, because it fails closed (users can’t see subcategory they expected to see), rather than failing open (users can see subcategory they… really shouldn’t).
---
### Author:  [@shoshber](https://meta.discourse.org/u/shoshber)
#### Post date: [April 30, 2018, 3:16am UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/14 "2018-04-30T03:16:04Z")
An update for anyone who stumbles on this thread in the future, like me. The posters above said that the contents of the posts appeared to be more restricted than their titles. That is no longer the case–clicking the topic titles doesn’t result in an error.
---
### Author:  [@typeoneerror](https://meta.discourse.org/u/typeoneerror)
#### Post date: [September 19, 2018, 3:33am UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/15 "2018-09-19T03:33:22Z")
This still appears to be a thing and bit a number of our clients in the bum. Is this a planned feature or do we have to instruct to be super-duper careful to set the same permissions as the parent category each time they add a new Subcategory?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 19, 2018, 4:22am UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/16 "2018-09-19T04:22:58Z")
Probably easiest thing here is a default-on “inherit” checkbox at the time of subcategory creation.. what do you think @sam?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [September 19, 2018, 6:36am UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/17 "2018-09-19T06:36:38Z")
I think the ideal thing to add some sort of safety net when you change parent permissions to ensure there is no case where and child subcategory is **less** restrictive than parent. Add that same safety net when saving a child category.
The worst case is when you can not access a parent but have access to a child. Stuff simply does not work right.
I think simply raising errors for now when you try to save in such conditions is the best path forward.
Eg:
> Parent:
>
> Staff: read
> Child:
>
> Team: read
(click save on child)
🎆 💣
> Users in child category will not have access to parent category, save is not allowed!
---
### Author:  [@typeoneerror](https://meta.discourse.org/u/typeoneerror)
#### Post date: [September 20, 2018, 9:42pm UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/18 "2018-09-20T21:42:40Z")
This would be killer. On this client we’re creating Groups for each cohort of the program they are running. If they accidentally forget to assign the group to the subcategories, topics are broadcast publicly. Not only would this save lots of time having to assign groups to each category, it’d get rid of the potential for accidentally leaking content for private groups.
---
### Author:  [@Christopher\_Batcheld](https://meta.discourse.org/u/Christopher_Batcheld)
#### Post date: [November 26, 2018, 11:51am UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/19 "2018-11-26T11:51:19Z")
I completely agree and add my support to this feature. We are also working with learning groups and teams from different organizations and the risks are potentially high. I’ve actually thought perhaps we should be using separate Discourse installations to keep this from happening. Would love to see this feature implemented for all the reasons listed above by others. Many thanks to those who are working on this!
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 28, 2018, 2:36am UTC](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174/20 "2018-11-28T02:36:48Z")
> [@Christopher\_Batcheld](#):
>
> the risks are potentially high
Keep in mind, if the risks are high I strongly recommend running a second instance, we do so as well and have our internal, for the company only, discussions in a private instance. It provides a significantly higher barrier and internal company memos don’t accidentally find themselves on meta this way.
No matter what we do to clean up category permissions the vector of “user picking wrong category… disaster” is not something any UX can completely eliminate.
The category permission stuff re inheritance is definitely something we will fix though. At a minimum not allow any cases to save where child is less restrictive than parent.
[Next page](https://meta.discourse.org/t/subcategories-do-not-inherit-permissions-from-parent-category/17174.md?page=2)